Where does zulip-term look for ssl certificate. Getting error "Error connecting to Zulip server: SSL Error (get_messages, register)." with self-signed-cert

[Laanan]

[neiljp]

@Laanan We use the python zulip module to connect to the server, so this is likely related to how this module works with self-signed certs. We haven't had many requests for this yet, but this would be good to fix or document, and of course get working for you :)

Which route did you take to specify your server and login information?

You might try reading the documentation (https://pypi.org/project/zulip/) to specify certificates, though currently ZT doesn't pass through command-line parameters to the library so you may have to alter the zuliprc file you have.

[Laanan]

@neiljp The link you provided makes sense. I'll try modifying the zuliprc file to point it to the cert and let you know how it turns out!

[Laanan]

@neiljp , I made the changes to the zuliprc file, which got it running. I do keep getting the error, below:

Unverified HTTPS request is being made to host 'zulip.bingsonwong.local'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings
│

Is this because it is a self-signed cert? I used the certutil tool, but, even in my browser the cert is considered untrusted. This is the zulip.combined-chain.crt file that the Zulip server install script pumps out. Any ideas or pointers? I am guessing I am making a really novice error. Thanks for any advice!

[timabbott]

Generally we recommend using Certbot unless you have a strong reason to do so, because self-signed certificates require a lot of work to make every tool accept them that's very avoidable.

@neiljp maybe to close this issue for the terminal project, we should just add a section in the zulip-terminal documentation linking to the relevant part of the pythoin-zulip-api certificates docs?

[Laanan]

Ok, thanks for the help. Aside from my self-inflicted SSL difficulties, Zulip is great! Already helping my staff stay connected and coordinated :-)

[neiljp]

@timabbott We can certainly add an FAQ entry, which seems like the logical place to put something like this.

The reason I asked about the origin of the zuliprc file was since ZT doesn't add an extra line for this in the file it generates (it has the server/username and generates the API key, but doesn't ask for cert details), and I'm not sure if the file generated by the server for each user/bot does/should do this? That affects the advice we would put in the FAQ entry.

[neiljp]

@Laanan Glad things are working for you now 👍 Did you acquire the zuliprc file from the webapp or via ZT? Where did you look for help before filing an issue here? (we can improve how easy it is to find this help)

[neiljp]

@Laanan Would the pointer to the Zulip API documents (as in the commit just above) solve this kind of issue for you in future? Or did you make some other kind of change or need some other information too?

[Laanan]

@neiljp Hello, yes the link https://pypi.org/project/zulip/ provided all the info I needed. As it turns out, adding the --cert-bundle= worked great. No problems with SSL after that! :-)